# PrizeVault.maxDeposit() doesn't take into account produced fees

PrizeVault.maxDeposit() ignores accrued yield fees, so a max deposit can fill the TWAB supply limit and lock yieldFeeRecipient's fees until withdrawals free space.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: pa6kuda
- Disclosed: 2024-04-04
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-pooltogether-findings/issues/91
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-pooltogether%3AM-07
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** PrizeVault.sol maxDeposit/claimYieldFeeShares
**Root cause:** maxDeposit() returns the full TWAB supply limit without subtracting yieldFeeBalance, so a deposit at that limit leaves no share capacity for fee minting.
**Steps:**
1. Set yield fee percentage to 10% and recipient to bob.
2. Alice deposits 1e18; mint 1e18 yield to vault and liquidate half via transferTokensOut to accrue fees.
3. Alice calls deposit(vault.maxDeposit(alice), alice), filling the TWAB supply limit.
4. Bob calls claimYieldFeeShares(yieldFee); _mint reverts due to uint96 overflow.
**How found:** Code review of maxDeposit() noticed it caps by _twabSupplyLimit(_totalSupply) but does not account for yieldFeeBalance, which is minted later via claimYieldFeeShares.
**Exploitation:** Any depositor can call deposit with maxDeposit() to consume the remaining TWAB share capacity; accrued yield fees then cannot be minted to the fee recipient until enough withdrawals reduce totalSupply.
**Insight:** When a deposit cap is enforced via a share-supply limit, subtract any shares that will be minted later (accrued fees, pending rewards) from the cap; otherwise a max deposit can block those mints.